solana-core-4

{"modified":"2026-07-09T22:58:22Z","published":"2026-06-09T03:26:08Z","schema_version":"1.7.4","id":"MAL-2026-5358","summary":"Malicious code in solana-core-4 (npm)","details":"Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling (c960/c961). postinstall scripts/postinstall.js auto-execs, src/index.js harvests ~/.ssh/id_rsa+wallet keys/seeds+env, self-labels \"CRYPTO STEALER\", exfils to IDENTICAL Telegram bot 8227918239 chat 6433587894 (not rotated). Generic-crypto-name + numeric suffix + 1.0.0 pattern.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (61592bcace57b51c5e1371d9645f1a3ab04ea4d9e148dcacca192ed98e82e36c)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n\n## Source: ossf-package-analysis (efb376d3542aadcfbbb9f689dcfcd73534f230fbe75ed465327444685097fd6d)\nThe OpenSSF Package Analysis project identified 'solana-core-4' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"ecosystem":"npm","name":"solana-core-4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"solana-core-4-1.0.0.tgz","hashes":{"sha1":"8d53d6e72856eaa275f2c940cebc94f1bbc1a0b8","sha512_sri":"sha512-bQg7RyYDlwOoKtz3Na20TMXTUq7p3KgKLY6vF3/xCfkmkuwBEnaB/1fgEurl9lgc6kqLvElqzLbTBsHFiLczzg=="}}]}}}],"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KTN5C8PDTMRFMHPJX8KW1TNG"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/solana-core-4/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]},{"name":"OpenSSF: Package Analysis","type":"FINDER","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"]},{"name":"SafeDep","type":"FINDER","contact":["https://safedep.io"]}],"database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","sha256":"efb376d3542aadcfbbb9f689dcfcd73534f230fbe75ed465327444685097fd6d","import_time":"2026-06-09T12:03:47.849959932Z","modified_time":"2026-06-09T03:26:08Z","versions":["1.0.0"]},{"source":"amazon-inspector","sha256":"61592bcace57b51c5e1371d9645f1a3ab04ea4d9e148dcacca192ed98e82e36c","import_time":"2026-07-09T22:56:27.558566627Z","id":"IN-MAL-2026-009488","modified_time":"2026-07-09T22:02:48Z","versions":["1.0.0"]}]}}